In October 2025 the UK Upper Tribunal handed down judgment in the Clearview AI case. The tribunal upheld three of the Information Commissioner’s Office grounds of appeal, confirming that Clearview’s processing of personal data was linked to the monitoring of UK residents and that it could not claim to fall outside UK data protection law on the basis that it served only foreign law enforcement. The tribunal also found that the lower tribunal had erred in law in applying the relevant provision.
The core dispute: jurisdiction and “behaviour monitoring”
The key issue was not facial recognition technology itself but two legal questions.
The trigger for extraterritorial jurisdiction. If a controller is registered abroad, its servers are abroad and its clients are abroad, does UK law simply not apply? The tribunal said no. The test is whether the processing relates to data subjects in the UK.
What counts as behaviour monitoring. One connection point for extraterritorial application of UK data protection law is the monitoring of data subjects’ behaviour in the UK. The tribunal considered that a facial database continuously collecting, storing and used for identification amounts to monitoring UK residents, regardless of who the service is ultimately delivered to.
Why the ruling matters
Cross-border disputes over AI training data and web scraping have increased. Companies commonly argue that data came from the public internet, that the service is not aimed at that market, or that the client is abroad. Clearview narrows the room for such arguments: the focus is the actual effect of processing, not the formal location of the entity.
For companies in facial recognition, scraping and profiling, this means compliance assessment must shift from “where am I registered” to “whose behaviour does my processing affect”. See our note on face recognition filing.
Contrast with the EU approach
The EU regulates facial recognition and biometric data more strictly, listing biometric data as a special category under the GDPR and requiring a higher lawful basis. Although the UK has an independent regime after Brexit, this case shows its approach to extraterritorial application and behaviour monitoring is close to the EU’s. See our GDPR and cross-border service.
Three takeaways
First, redo the data map. Identify whether training and business data contain overseas facial or biometric information, and how processing affects overseas subjects.
Second, reassess the “publicly available” defence. Data coming from the public internet does not by itself provide a lawful basis, especially where the purpose is identification and profiling. See our note on obligations of major personal information processors.
Third, state data provenance and compliance responsibility in contracts. When procuring third-party data or models, require representations and warranties on lawful provenance. See our note on AI commercial contract clauses and our multi-jurisdiction service.
Clearview, alongside EU and US enforcement, shows that the jurisdictional boundary in the AI era is migrating from where the entity sits to where the effect lands.
This article is based on the UK Upper Tribunal judgment in the Clearview AI case and on public information. It is for general reference only and does not constitute legal advice.